Problems integrating ADFS with the SAML Spring extension

Question

I am working on integrating the Spring SAML extension in our application and for SSO with one of our ADFS2.0 clients as IDP, which we created service provider metadata from our applications and imported ADFS metadata in our application. When I select the idp clients and click on the first single and issue the correct client credentials, we see the SAML response as follows:

Saml Response.

<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" Consent="urn:oasis:names:tc:SAML:2.0:consent:unspecified" Destination="https://sso.spire2grow.com:8443/<our application>/saml/SSO" ID="_d7fa7cb7-a858-4d4e-aa4c-bf7a5d11e485" InResponseTo="a2icei36d347di68gi33534cc13fd1" IssueInstant="2014-09-30T14:17:21.819Z" Version="2.0"><Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion"><Clients ADFS trust services URL></Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Responder"></samlp:StatusCode></samlp:Status></samlp:Response> 

but also I see the following exception that is being thrown because the service provider cannot check the message.

Exception Message:

 [351545]2014-09-30 19:47:21,714 DEBUG - SAML message intended destination endpoint matched recipient endpoint [351545]2014-09-30 19:47:21,714 DEBUG - Authentication attempt using org.springframework.security.saml.SAMLAuthenticationProvider [351545]2014-09-30 19:47:21,715 DEBUG - Error validating SAML message org.opensaml.common.SAMLException: Response has invalid status code urn:oasis:names:tc:SAML:2.0:status:Responder, status message is null at org.springframework.security.saml.websso.WebSSOProfileConsumerImpl.processAuthenticationResponse(WebSSOProfileConsumerImpl.java:113) at org.springframework.security.saml.SAMLAuthenticationProvider.authenticate(SAMLAuthenticationProvider.java:82) at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:156) at org.springframework.security.saml.SAMLProcessingFilter.attemptAuthentication(SAMLProcessingFilter.java:84) at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:195) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342) 

Can anyone point out that I'm doing something here here.

UPDATE:

After looking at the answer to this question, I saw the following error from ADFS.

 Microsoft.IdentityServer.Protocols.Saml.SamlProtocolSignatureAlgorithmMismatchException: MSIS7093: The message is not signed with expected signature algorithm. Message is signed with signature algorithm http://www.w3.org/2000/09/xmldsig#rsa-sha1. Expected signature algorithm http://www.w3.org/2001/04/xmldsig-more#rsa-sha256. at Microsoft.IdentityServer.Web.Protocols.Saml.SamlProtocolManager.ValidateSignatureRequirements(SamlMessage samlMessage) at Microsoft.IdentityServer.Web.Protocols.Saml.SamlProtocolManager.Issue(HttpSamlRequestMessage httpSamlRequestMessage, SecurityTokenElement onBehalfOf, String sessionState, String relayState, String& newSamlSession, String& samlpAuthenticationProvider, Boolean isUrlTranslationNeeded, WrappedHttpListenerContext context, Boolean isKmsiRequested) 

But, having seen this, we changed the Signing algorithm on the relying side of trust to rsa-sha256, but still displayed the same message.

Do we need a genuine certificate for rsa-sha256? Will the self-signed certificate work correctly?

Answer 1

An exception from ADFS complains that the SAML message was not signed with RSA-SHA256, which it expects, but with RSA-SHA1.

Be sure to install the Spring SAML Repeater Signing Algorithm in ADFS on SHA-1. You can find the information at the last marker point http://docs.spring.io/autorepo/docs/spring-security-saml/1.0.x-SNAPSHOT/reference/htmlsingle/#chapter-idp-guide-adfs-sp

Answer 2

Value = "urn: oasis: names: dts: SAML: 2.0: Status: Respondent"

See the SAML kernel specification. It says:

urn: oasis: names: dts: SAML: 2.0: Status: Responder The request could not be completed due to an error on the part of the SAML responder or SAML.

i.e. The ADFS server had problems interpreting or responding to the request. IdP should tell you what the problem is.

Answer 3

Spring SAML Security Extension does not support SHA-256 by defualt. You can extend the org.springframework.security.saml.SAMLBootstrap class to provide SHA-256.

Cancel the postProcessBeanFactory method

 public class Bootstrap extends SAMLBootstrap { @Override public void postProcessBeanFactory(ConfigurableListableBeanFactory beanFactory) throws BeansException { super.postProcessBeanFactory(beanFactory); BasicSecurityConfiguration config = (BasicSecurityConfiguration) Configuration .getGlobalSecurityConfiguration(); config.registerSignatureAlgorithmURI("RSA", SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256); config.setSignatureReferenceDigestMethod(SignatureConstants.ALGO_ID_DIGEST_SHA256); }